OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could rec

The primary impact of CVE-2019-10165 is unauthorized access to resources within the OpenShift Container Platform. An attacker who can access the audit logs—which may be accessible to administrators or through compromised accounts—can extract OAuth tokens. These tokens grant access to various Kubernetes and OpenShift API resources, potentially allowing the attacker to escalate privileges, read sensitive data, or even modify configurations. The blast radius is limited to the resources accessible through the compromised OAuth token, but the potential for damage is significant if the token grants broad permissions. This vulnerability shares similarities with other token leakage issues where improperly secured tokens can be exploited for unauthorized access.

Organizations using OpenShift Container Platform versions 4.1.0, 4.1.1, and 4.1.2 are at risk. Environments with lax access controls to audit logs are particularly vulnerable, as are those where administrators routinely access and review audit logs without proper security precautions.

• linux / server:

journalctl -u auditd | grep -i 'oauth token'

• kubernetes / server: Inspect Kubernetes audit logs for plaintext OAuth tokens. Review RBAC configurations to ensure least privilege access. • generic web: Review access logs for unusual access patterns to the audit log endpoint.

1. 2019-07-30Disclosure

   disclosure

1. 已保留2019-03-27
2. 发布日期2019-07-30
3. 修改日期2024-08-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2019-10165 is to upgrade OpenShift Container Platform to version 4.1.3 or later, which includes the fix. If upgrading immediately is not possible, consider restricting access to the audit logs to only authorized personnel. Implement robust access controls and monitoring to detect any suspicious activity related to the audit logs. While not a direct fix, enabling audit log encryption can help protect the confidentiality of the tokens, although it does not prevent them from being logged in the first place. After upgrading, confirm the fix by verifying that OAuth tokens are no longer written in plaintext to the audit logs.